This vulnerability in ThimPress Thim Elementor Kit (<= 1.2.8) is due to missing authorization checks, which leads to incorrect access control enforcement. An attacker with low privileges could exploit this issue remotely over the network without user interaction to gain limited unauthorized access to information. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality impact without integrity or availability impact.

The impact is limited to partial confidentiality loss, with no integrity or availability effects. An attacker with low privileges could access data they should not be authorized to view due to missing authorization checks. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor for updates from ThimPress and consider restricting access to the affected plugin or limiting privileges where possible to reduce exposure.